October 14, 2026: Zero-Days Exploited, AI Fuels Ransomware, DDoS Surges

Critical Vulnerabilities Under Active Exploitation:

• Microsoft's Record October Patch Tuesday Fixes 1,413 Flaws, 1 Exploited Zero-Day: Microsoft released its largest-ever security update, addressing 1,413 CVEs. This includes a patch for an actively exploited zero-day in Windows Shell (CVE-2026-96951) that bypasses the Mark of the Web feature. CISA has added this flaw to its KEV catalog, mandating immediate patching for federal agencies.
• CISA Warns of Actively Exploited Zero-Day in Ivanti Connect Secure: CISA issued an urgent warning for CVE-2026-104935, a critical authentication bypass vulnerability in Ivanti Connect Secure (ICS) appliances. This zero-day is being exploited for remote command execution and data exfiltration. CISA has added it to its KEV catalog, requiring federal agencies to patch by October 16, 2026.

New Threats and Advisories:

• AI Exploited in 84% of Ransomware Attacks, Report Finds: A Semperis report indicates AI was a factor in 84% of ransomware attacks, with 44% involving attackers weaponizing victim AI systems. The report also notes an increase in physical threats and psychological intimidation, with identity systems like Active Directory remaining primary targets.
• Johnson Investment Counsel Discloses Data Breach via Third-Party MSP: Wealth management firm Johnson Investment Counsel reported a data breach originating from a third-party managed service provider (MSP), exposing client PII. The 'Storm' ransomware group has claimed responsibility for allegedly stealing 39.6 GB of data.
• Retailer Claire's Investigates Data Breach Claim by 'Dark Project' Group: Claire's is investigating a potential data breach after the 'Dark Project' group claimed to have stolen 1.71 terabytes of data on October 12, 2026. The scope of compromised data, potentially including customer and employee information, is unconfirmed.
• Multiple Data Breaches Hit Tech, Manufacturing, and Logistics Firms: On October 13, 2026, several data breaches impacted global companies in technology, manufacturing, and logistics. Threat actor groups including OROVA, n0n, MAJINAHANASHI, and DragonForce have claimed responsibility.
• High-Capacity DDoS Attacks Surge 1,286% in 2026, NETSCOUT Reports: NETSCOUT's report shows a 1,286% year-over-year increase in high-capacity DDoS attacks (over 1Tbps) in the first half of 2026. The report documented over 9.1 million attacks globally and noted a shift towards residential proxies and short, rate-based attacks.

Policy & Industry Notes:

• DOE and INL Launch Cyber-Informed Engineering Initiative for Energy Sector: The U.S. Department of Energy (DOE) and Idaho National Laboratory (INL) have initiated a program to integrate cybersecurity principles into the design of energy infrastructure. This Cyber-Informed Engineering (CIE) initiative aims to enhance resilience by leveraging engineered controls.